GDPR EU Representative: When Non-EU SaaS and HealthTech Companies Need One

Short answer: A GDPR EU representative is a person or organisation in the EU that a non-EU controller or processor designates in writing under Article 27. You need one if you have no EU establishment but offer goods or services to people in the EU or monitor their behaviour there, unless a narrow exemption applies.

Related guides:

• Who should comply with the GDPR?
• GDPR compliance for US companies: a step-by-step guide
• UK GDPR explained

Key takeaways

• The trigger is Article 3(2). If you have no EU establishment but target or monitor people in the EU, Article 27 generally requires a representative.
• The exemption is narrow. It covers only occasional, low-risk processing that does not include large-scale special category or criminal offence data, plus public authorities.
• A representative is not a DPO. The EDPB treats the representative role as incompatible with acting as your external DPO.
• No liability shield and no one-stop-shop. You stay fully responsible, and a representative does not give you a lead supervisory authority.
• The UK is separate. Since Brexit, the UK GDPR has its own representative requirement for organisations outside the UK.

Do I need an EU representative under Article 27?

You need one if the GDPR applies to you through Article 3(2) and you have no establishment in the EU, unless you fall within the Article 27(2) exemption.

The GDPR reaches companies outside the EU in two ways. Article 3(1) covers processing in the context of an EU establishment. Article 3(2) covers controllers and processors with no EU establishment when their processing relates to (a) offering goods or services to people in the Union, whether or not payment is required, or (b) monitoring their behaviour as far as that behaviour takes place in the Union. Article 27(1) then says that where Article 3(2) applies, the controller or processor "shall designate in writing a representative in the Union."

Common scenarios for US SaaS and HealthTech companies:

Scenario	Likely Article 3(2) trigger	Representative question
Self-serve SaaS sold to users in Germany and France, priced in euros	Offering services to people in the EU	Article 27 likely applies
Patient app that tracks symptoms and location for EU users	Monitoring behaviour in the EU	Article 27 likely applies, and health data makes the exemption hard to rely on
US-only clinic software with no EU marketing or EU users	No targeting or monitoring	Article 27 likely does not apply
US parent with an EU subsidiary that runs the processing	Article 3(1) establishment	Article 27 does not apply to that processing

Whether you "target" the EU depends on facts such as language, currency, delivery to EU countries and marketing aimed at EU users. The EDPB Guidelines 3/2018 on the territorial scope of the GDPR, adopted in final form on 12 November 2019, are the main reference for that analysis.

When does the Article 27(2) exemption apply?

The exemption applies only to occasional, low-risk processing that does not include large-scale special category or criminal offence data, or to public authorities and bodies.

Article 27(2) of the GDPR sets out two separate cases:

1. Occasional processing. The processing must be occasional, must not include processing of special categories of data under Article 9(1) or criminal convictions and offences data under Article 10 on a large scale, and must be unlikely to result in a risk to the rights and freedoms of natural persons. All three conditions must hold together.
2. Public authorities or bodies. These are exempt regardless of the nature of the processing.

The EDPB reads "occasional" narrowly. In its Guidelines 3/2018, processing counts as occasional only if it is not carried out regularly and falls outside the regular course of the controller's business. In our experience, a SaaS product that EU customers use every day rarely fits. A HealthTech company processing health data, which is special category data under Article 9, faces a further hurdle if that processing is large scale. See our guide on GDPR special category data for how Article 9 works.

If you rely on the exemption, document why and revisit it when you launch new markets or add tracking.

What does a GDPR EU representative actually do?

The representative is your contact point in the EU for supervisory authorities and data subjects, and it shares certain record-keeping and cooperation duties with you.

Under Article 27(4) of the GDPR, supervisory authorities and data subjects can address the representative in addition to or instead of you on all issues related to processing. It also shares duties with you:

• Maintaining records. Article 30(1) and 30(2) require the controller or processor and, where applicable, its representative to maintain a record of processing activities. Article 30(4) requires the record to be made available to the supervisory authority on request. The EDPB says the non-EU controller remains responsible for the primary content and updates of the record. Our GDPR Article 30 guide covers what the record must contain.
• Cooperating with regulators. Article 31 requires controllers, processors and, where applicable, their representatives to cooperate with the supervisory authority on request.
• Being named to individuals. Article 13(1)(a) requires you to give data subjects the identity and contact details of your representative, usually in your privacy notice.

Article 27(5) is the part founders often miss: designating a representative is without prejudice to legal actions that could be brought against the controller or processor itself. The EDPB adds that the GDPR does not create a substitutive liability of the representative for your violations, although supervisory authorities can address corrective measures or fines to the representative. Its direct liability is limited to its own obligations under Article 30 and Article 58(1)(a).

Where must the representative be established, and what goes in the mandate?

The representative must be established in one of the member states where the data subjects you target or monitor are, and must be appointed by a written mandate.

Article 27(3) of the GDPR sets the location rule. The EDPB guidelines add three practical points:

• Where a significant proportion of your data subjects are in one member state, establishing the representative there is good practice.
• The representative must remain easily accessible to data subjects in the other member states where you operate.
• Communication should generally be possible in the languages used by the supervisory authorities and data subjects concerned.

The EDPB also confirms that the representative can be a natural or a legal person established in the Union, and that one representative can act for several non-EU controllers and processors.

Recital 80 calls for the representative to be explicitly designated by a written mandate to act on your behalf. A practical mandate usually covers:

• scope: which entities, products and processing activities it covers
• duties: forwarding requests, the Article 30 record and regulator cooperation
• response times, supported languages, and how you share processing changes
• term, termination and handover of records

Once signed, publish the representative's details in your privacy notice and on your website.

EU representative vs DPO vs lead supervisory authority: what is the difference?

A representative acts on your instructions as your EU contact point, a DPO independently advises and monitors your compliance, and a lead supervisory authority is the regulator that the one-stop-shop assigns to companies with an EU establishment.

	EU representative	Data protection officer (DPO)
Legal basis	Article 27	Articles 37 to 39
When required	Article 3(2) applies, no EU establishment, no exemption	Public authority, or core activities involving large-scale regular and systematic monitoring, or large-scale special category or criminal offence data (Article 37(1))
Independence	Acts on your behalf and under your mandate	Must not receive instructions on how to perform its tasks (Article 38(3))
Main audience	Supervisory authorities and data subjects contacting you	Your organisation, which it advises and monitors
Same person for both?	Not recommended: the EDPB considers the roles incompatible	Not recommended: the EDPB considers the roles incompatible

The two obligations are independent. A US HealthTech company processing health data at scale may need both a DPO under Article 37(1)(c) and a representative under Article 27, and the EDPB guidelines say the representative function is not compatible with the role of an external DPO, because a representative acts under the controller's direct instruction while a DPO must be independent.

The lead supervisory authority question trips up many teams. Under Article 56(1) of the GDPR, the authority of the main or single establishment acts as lead authority for cross-border processing. The EDPB states that the presence of a representative in the Union does not constitute an "establishment," and that a controller without an EU establishment cannot benefit from the one-stop-shop mechanism.

Do you also need a UK GDPR representative?

Yes, if you have no UK establishment and offer goods or services to, or monitor, people in the UK, you likely need a separate UK representative in addition to any EU representative.

After Brexit, the UK runs its own regime under the UK GDPR. The ICO's guidance on UK representatives says a controller or processor based outside the UK with no UK office that offers goods or services to, or monitors, individuals in the UK may need to appoint a representative in the UK. The exemptions mirror the EU text: public authorities, and processing that is only occasional, low risk and does not involve large-scale special category or criminal offence data. The appointment must be in writing, the representative may be an individual or an organisation established in the UK, and appointing one does not reduce your own responsibility or liability.

An EU representative cannot cover the UK, and a UK representative cannot cover the EU. The ICO's guidance on European representatives makes the same point from the other direction for UK organisations without an EEA establishment.

How do you choose and appoint an EU representative?

Confirm that Article 27 applies, pick a representative in the right member state that is not your DPO, sign a written mandate and publish its details.

Use this checklist:

1. Confirm scope. Document why Article 3(2) applies, product by product, and repeat the test for the UK.
2. Test the exemption honestly. Record whether processing is occasional, low risk and free of large-scale special category or criminal offence data.
3. Choose the member state. Map where your EU users are. Favour the member state with a significant share of them.
4. Check independence. Do not appoint your external DPO as your representative.
5. Check response times. Ask about languages, how requests are logged and forwarded, and how regulator letters are handled.
6. Sign a written mandate. Cover scope, duties, Article 30 record access, timelines, term and termination.
7. Share your Article 30 record. Give the representative a current copy and a process for updates.
8. Publish details. Add the representative's identity and contact details to your privacy notice and website.
9. Brief internal teams. Support, legal and security should know what the representative forwards and who answers.
10. Review yearly. Re-run the analysis when you launch new markets, add tracking or start processing health data at scale.

How SecureSlate helps

SecureSlate helps non-EU SaaS and HealthTech teams run their GDPR program alongside other frameworks. Built-in GDPR support, with multi-framework control mapping to SOC 2, ISO 27001, HIPAA and HITRUST, lets you track the Article 27 decision, the representative mandate and the Article 30 record as controls with owners and evidence. Custom frameworks and controls let you add UK GDPR representative steps, and vendor risk management helps you track your representative and DPO service providers as vendors. Risk management records exemption reasoning, and the trust center and security questionnaire automation help you answer customer questions about your EU and UK contacts.

FAQ

Is an EU representative the same as a DPO?

No. A representative acts on your instructions as your EU contact point under Article 27. A DPO under Articles 37 to 39 advises and monitors independently. The EDPB considers the two roles incompatible in the same person.

Can a US company avoid appointing a representative by having an EU customer as a data controller?

Not automatically. If you act as a processor for EU customers and Article 3(2) applies to your processing, Article 27 covers processors too. Analyse your own role and processing, not only your customers' obligations.

Does an EU representative give us a lead supervisory authority?

No. The EDPB states that a representative is not an establishment, so a controller without an EU establishment cannot use the one-stop-shop. Article 27(4) lets supervisory authorities address the representative on processing issues.

Disclaimer (legal note)

This article is for general information only and is not legal, regulatory or professional advice. Requirements vary by framework, industry and jurisdiction. Consult qualified advisors for your specific obligations.